The omec-project UPF pfcpiface component is vulnerable to a denial of service attack that can be triggered by unauthenticated remote attackers to crash the UPF process.

The vulnerability is a nil pointer dereference occurring when the UPF receives a PFCP Session Report Response missing a mandatory Cause Information Element. This flaw is reachable by an unauthenticated attacker who can send crafted PFCP messages to the N4/PFCP endpoint, resulting in a process panic and service termination.

The exploitation of this vulnerability leads to the disruption of user-plane services, which can cause significant network outages for downstream subscribers. Given the CVSS score of 7.5, the vulnerability is considered high risk because it is network-accessible and requires no authentication to trigger, facilitating easy exploitation by remote actors.

Immediate Action: Monitor the upstream omec-project GitHub repository for the release of a patch or updated version that addresses the nil pointer dereference in the pfcpiface component.

Proactive Monitoring: Review system logs for frequent crashes or unexpected restarts of the UPF process and monitor N4 interface traffic for abnormal PFCP Session Report Response messages.

Compensating Controls: Implement strict network access control lists (ACLs) on the N4/PFCP interface to ensure that only authorized control plane elements can communicate with the UPF.

Public Exploit Available: Unknown

Security teams should treat this vulnerability with high priority due to the potential for service instability and the lack of authentication required for exploitation. Administrators must restrict network access to the N4/PFCP interface immediately and prioritize the deployment of vendor-supplied patches as soon as they become available.